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We  are  providing  this  final  report  for  your  review  and  comments.  It  discusses 
data  input  controls  for  the  Mechanization  of  Contract  Administration  Services  System. 
Comments  on  a  draft  of  this  report  were  considered  in  preparing  the  report. 

DoD  Directive  7650.3  requires  that  all  audit  recommendations  be  resolved 
promptly.  Therefore,  the  D^uty  Comptroller  of  the  Department  of  Defense  (Financial 
Systems)  is  requested  to  provide  comments  on  the  unresolved  recommendations  by 
January  30,  1995.  See  the  "Response  Requirements  for  Each  Recommendation" 
section  at  the  end  of  each  finding  with  unresolved  recommendations  for  the  specific 
requirements  for  your  comments. 
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(317)  542-3859  (DSN  699-3859)  or  Mr.  Stephen  A.  Delap,  Project  Manager,  at  (614) 
337-8009.  The  distribution  of  this  report  is  listed  in  Appendix  I.  A  list  of  audit  team 
members  is  inside  the  back  cover. 
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for  Auditing 
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Report  No.  95-046 

(Project  No,  3FI-4001) 

DATA  INPUT 

CONTROLS  FOR  THE  MECHANIZATION  OF  CONTRACT 
ADMINISTRATION  SERVICES  SYSTEM 


EXECUTIVE  SUMMARY 


Introduction.  The  Defense  Finance  and  Accounting  Service  Center  at  Columbus, 
Ohio  (DFAS  Columbus  Center),  was  established  in  January  1991.  The  DFAS 
Columbus  Center  has  3  Contract  Administration  Services  directorates  with  16  contract 
payment  divisions  that  administer  the  payment  functions  formerly  carried  out  by  the 
Defense  Contract  Administration  Services  Regions  and  their  payinent  offices.  The 
three  Contract  Administration  Services  directorates  use  the  Mechanization  of  Contract 
Administration  Services  O'^OCAS)  automated  system  to  generate  contract  payments 
using  Army,  Navy,  Air  Force,  and  other  Defense  agencies'  funds.  During  cmendar 
year  1993,  the  DFAS  Columbus  Center  paid  more  than  1.3  million  invoices  totaling 
about  $85  billion. 

Objectives.  The  overall  audit  objective  was  to  evaluate  the  adequacy  of  MCXDAS 
controls  over  automated  data  input.  Specifically,  we  determined  whether  MOCAS  had 
automated  input  controls  that  were  adequate  to  prevent,  detect,  and  correct  erroneous 
and  duplicate  data  entered  by  personnel  at  the  DFAS  Columbus  Center;  whether 
MOCAS  identified  erroneous  data  transferred  from  supporting  systems;  and  whether 
data  rejected  at  initial  input  were  properly  managed,  corrected,  and  reentered  in  a 
timely  manner. 

Audit  Results.  The  audit  concluded  that  MOCAS  controls  over  automated  data  input 
were  not  adequate.  Specifically,  MOCAS  acc^ted  invalid  data  in  57  of  the 
484  automated  input  fields  test^,  and  edit  tables  available  from  the  Military 
Departments,  which  could  significantly  improve  the  accuracy  of  MOCAS  data,  were 
not  being  us^  (Finding  A).  As  a  result,  negative  unliquidat^  obligations,  unmatched 
disbursements,  and  incorrect  or  duplicate  payments  could  occur.  Also,  data  rejected  at 
initial  input  were  not  properly  managed,  corrected,  and  reentered  in  a  timely  manner 
(Finding  B),  and  access  controls  were  not  adequate  to  prevent  unauthorized  access  to 
Ae  MOCAS  system  (Finding  C). 

Internal  Controls.  The  DFAS  Columbus  Center  had  inadequate  internal  controls  over 
automated  data  input  to  MOCAS,  over  the  correction  and  reentry  of  data  rejected  at 
initial  input  and  over  user  access.  See  Part  I,  "Internal  Controls,"  and  Part  n.  Findings 
A,  B,  and  C,  for  more  details  on  the  internal  controls  examined  and  the  results  of  our 
examination. 

Potential  Benefits  of  Audit.  We  could  not  quantify  the  potential  monetary  benefits  of 
implementing  the  recommendations.  However,  implementation  will  significantly 
improve  the  accuracy  of  MOCAS  data,  including  die  critical  accounting  data  needed  by 
Military  Departments'  accountable  stations,  and  help  stop  the  creation  of  new 
unmatched  disbursements.  See  Appendix  G  for  a  description  of  benefits  associated 
with  this  audit. 

Sununary  of  Reconunendations.  We  recommended  use  of  the  Military  Departments' 
edit  and  validation  tables  in  MOCAS  as  controls  over  data  accuracy  and  automated 
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controls  for  the  data  input  fields  that  aco^ted  invalid  data.  We  also  recommended 
issuing  guidance  concerning  MOCAS  reject  listings,  updating  desk  procedures  for 
handling  automated  rqect  listings,  increasing  supervisory  reviews,  and  implementing 
controls  to  ensure  that  user  identifications  ate  promptly  canceled  when  no  longer 
need^. 

Management  Comments.  The  Deputy  Comptroller  (Financial  Systems),  responding 
to  recommendations  made  to  the  DFAS,  concurred  with  the  ne^  to  issue  guidance 
concerning  MOCAS  reject  listings,  updating  desk  procedures  for  handling  automated 
reject  listings,  increasing  supervisory  reviews,  and  implementing  controls  to  ensure  that 
user  identifications  are  promptly  canceled  when  no  longer  needed.  The  D^uty 
Comptroller  (Financial  Systems)  partially  concurred  with  three  other  recommendations. 


Audit  Response.  The  management  reply  to  the  draft  r^rt  was  generally  responsive. 
We  request  that  the  Deputy  Comptroller  (Financial  Systems)  provide  clarifying 
comments  on  certain  recommoidations  as  shown  in  the  charts  at  the  end  of  Findings  A 
and  C.  A  full  dscussion  of  the  comments  is  in  Part  n  of  this  report,  and  the  complete 
text  of  management  comments  is  in  Part  IV.  Additional  comments  are  requested  by 
January  30,  1995. 
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This  report  was  prepared  by  the  Financial  Management  Directorate,  Office  of  the 
Assistant  Inspector  General  for  Auditing,  Department  of  Defense. 


Part  I  -  Introduction 


Introduction 


Background 


The  Defense  Finance  and  Accounting  Service  Center  at  Columbus,  Ohio  (DFAS 
Columbus  Center),  was  established  in  January  1991  to  consolidate  the  payment 
functions  previously  carried  out  by  the  Defense  Logistics  Agency  (DLA) 
Finance  Center,  the  Defense  Contract  Administration  Services  Regions,  and 
their  various  paying  activities.  The  DFAS  Columbus  Center  originally 
consisted  of  5  Contract  Administration  Services  (CAS)  directorates  that  included 
16  contract  payment  divisions.  In  November  1993,  the  5  CAS  Directorates 
were  consolidated  into  3  directorates;  the  16  contract  payment  divisions  were 
maintained. 

The  three  CAS  Directorates  make  contract  payments  using  Army,  Navy, 
Air  Force,  and  other  Defense  agencies'  appropriated  funds.  During  calendar 
year  1993,  the  DFAS  Columbus  Center  paid  more  than  1.3  million  contractor 
invoices  totaling  $85  billion. 

The  DFAS  Columbus  Center  also  implements  financial  management  policies 
and  procedures  for  the  accounting,  certification,  and  disbursing  operations 
performed  by  the  Mechanization  of  Contract  Administration  Services  (MOCAS) 
system,  which  is  the  automated  system  used  to  generate  payments  for  contractor 
invoices.  As  of  January  1993,  the  DFAS  Columbus  Center  was  responsible  for 
348,536  active  contracts  valued  at  $489.0  billion.  By  January  1994,  this 
volume  had  increased  to  more  than  378,000  contracts  valued  at  $490.8  billion. 

OMB  Circular  No.  A-127.  Office  of  Management  and  Budget  (0MB)  Circular 
No.  A-127,  "Financial  Management  Systems,"  July  1993,  regulates  financial 
management  systems  and  internal  controls  for  all  executive  departments  and 
agencies. 

DoD  Directive  7200.1.  DoD  Directive  7200.1,  "Administrative  Control  of 
Appropriations,"  July  1987,  regulates  fund  control  for  all  DoD  Components. 
The  Directive  requires  DoD  Components  to  establish  and  maintain  adequate 
systems  of  accounting  and  positive  control  of  appropriations  and  other  funds. 


Objectives 


Our  objective  was  to  evaluate  the  adequacy  of  MOCAS  controls  over  automated 
data  input.  Specifically,  we  determined: 

o  whether  MOCAS  had  automated  input  controls  that  were  adequate  to 
prevent,  detect,  and  correct  erroneous  and  duplicate  data  entered  by  personnel  at 
the  DFAS  Columbus  Center; 

0  whether  MOCAS  identified  erroneous  data  transferred  from 
supporting  systems;  and 
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o  whether  data  rejected  at  initial  input  were  properly  managed, 
corrected,  and  reentered  in  a  timely  manner. 

We  also  evaluated  the  DFAS  Columbus  Center's  aimual  reviews  and  reports 
required  by  the  DoD  Internal  Management  Control  Program. 


Scope  and  Methodology 


We  conducted  this  financial-related  audit  from  August  1993  through 
March  1994.  We  considered  the  key  data  necessary  for  contract  management 
and  then  evaluated  484  automated  input  fields  using  30  MOCAS  input  screens 
used  for  contract  data,  contract  modifications,  and  invoices.  Personnel  at  the 
DFAS  Columbus  Center  use  these  screens  to  manage  the  DoD  contract 
administration  and  payment  functions.  Since  MOCAS  does  not  have  a  built-in 
testing  capability,  we  used  a  separate  test  database  provided  by  the  DLA 
Systems  Automation  Center  (DSAC). 

The  only  limitation  on  our  scope  was  that  the  DSAC  test  system  did  not  identify 
the  access  levels  (read  only,  update,  and  delete)  used  by  MOCAS.  Instead,  the 
test  system  recognized  us  as  valid  users,  and  we  were  authorized  to  add, 
modify,  or  delete  all  data  fields  on  each  of  Ae  30  screens  reviewed. 

We  also  reviewed  selected  data  that  had  been  rejected  during  overnight  batch 
processing  at  DFAS  Colmnbus  in  November  1993.  We  reviewed  these  data  to 
determine  whether  the  CAS  Directorates  had  properly  controlled,  corrected,  and 
reentered  them  in  a  timely  manner.  We  also  evaluated  controls  over  user 
identification  codes  (user  IDs)  for  11  input  screens  that  we  selected  using 
nonstatistical  methods. 

We  did  not  determine  whether  MOCAS  identified  erroneous  data  that  had  been 
transferred  from  supporting  systems.  Inspector  General  (IG),  DoD,  Report 
No.  94-054,  "Fund  Control  Over  Contract  Payments  at  the  Defense  Finance  and 
Accounting  Service-Columbus  Center,"  March  15,  1994,  recommended  that  the 
existing  Military  Standard  Contract  Administration  Procedures  (MILSCAP) 
interface  be  terminated.  Since  MILSCAP  is  the  only  direct  interface  between 
MOCAS  and  supporting  procurement  systems,  we  had  no  additional  data 
transfer  mechanisms  to  evaluate.  The  DLA  Pre- Award  Contracting  System  is 
currently  scheduled  to  replace  MILSCAP  by  October  1995. 

The  audit  was  made  in  accordance  with  auditing  standards  issued  by  the 
Comptroller  General  of  the  United  States  as  implemented  by  the  IG,  DoD,  and 
accordingly  included  such  tests  of  internal  controls  as  were  considered 
necessary.  We  tested  the  adequacy  of  controls  over  the  data  input  fields 
discussed  in  this  report  and  over  the  management  and  correction  of  rejected 
data.  Except  for  these  tests,  we  did  not  assess  the  reliability  of  computer- 
processed  MOCAS  data.  Appendix  H  lists  the  organizations  we  visited  or 
contacted. 
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Internal  Controls 


The  audit  identified  the  following  material  internal  control  weaknesses,  as 
defined  by  DoD  Directive  5010.38,  "Internal  Management  Control  Program," 
April  14,  1987. 

o  MOCAS  controls  over  automated  data  input  were  not  adequate  to 
ensure  that  only  valid  data  were  accepted. 

o  Data  rejected  at  initial  input  were  not  properly  managed,  corrected, 
and  reentered  in  a  timely  manner. 

o  Access  controls  were  not  adequate  to  prevent  unauthorized  users  from 
gaining  entry  to  the  system. 

In  its  FY  1993  Annual  Statement  of  Assurance,  the  DFAS  Columbus  Center 
had  identified  related  material  internal  control  weaknesses  in  the  areas  of  vendor 
overpayments,  inadequate  training,  and  lack  of  standard  operating  procedures. 
New  discrepancies  were  identified  as  management  has  yet  to  complete  a 
Management  Control  Review  on  all  facets  of  the  MOCAS  system.  In  addition 
to  problems  with  data  accuracy,  these  conditions  have  added  to  a  recurring 
problem  by  significantly  increasing  negative  unliquidated  obligations  (NULOs). 
A  contract  has  a  negative  balance  when  accounting  lines  with  negative 
obligation  values  exceed  lines  with  positive  values.  A  negative  balance  may  be 
caused  by  an  accounting  error  or  a  lack  of  funds  to  cover  unpaid  obligations. 
When  obligated  balances  exceed  available  funds,  a  violation  of  the 
Antideficiency  Act  may  occur. 

In  Report  No.  94-054  (see  "Scope  and  Methodology"),  we  found  that  as  of 
July  1993,  the  DFAS  Columbus  Center  had  reported  2,659  contracts  with 
negative  balances  totaling  $408  million.  By  April  1994,  the  DFAS  Columbus 
Center  had  2,779  contracts  with  negative  balances  of  $1.07  billion. 

Copies  of  the  report  will  be  provided  to  the  senior  officials  responsible  for 
internal  controls  within  the  DFAS. 


Prior  Audits  and  Other  Reviews 


Since  December  1991,  the  IG,  DoD,  has  issued  six  reports  on  the  adequacy  of 
MOCAS  controls  over  automated  data  input  and  related  issues. 

o  Report  No.  94-060,  "General  Controls  for  Computer  Systems  at  the 
Information  Processing  Centers  of  the  Defense  Information  Services 
Organization,"  March  18,  1994,  concluded  that  all  three  DISO  centers  had 
weaknesses  in  their  controls  over  computer  assets  (including  application 
programs),  which  increased  the  risk  of  unauthorized  access. 
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o  Report  No.  94-054  (see  "Scope  and  Methodology")  concluded  that  the 
MOCAS  system  contained  inaccurate  data  on  obligations  and  disbursements. 
The  inaccuracies  occurred  because  MOCAS  data  were  entered  incorrectly  and 
because  the  DFAS  Columbus  Center  had  problems  with  transferring  data  from 
MILSCAP-compatible  systems.  In  addition,  supervisors  at  the  DFAS 
Columbus  Center  were  not  reviewing  transaction  entries,  documenting  their 
reviews,  or  ensuring  that  input  clerks  were  correcting  errors  at  the  point  of  data 
entry. 


o  Report  No.  94-048,  "Uncleared  Transactions  For  and  By  Others," 
March  2,  1994,  concluded  that  DFAS  had  not  taken  prompt  and  effective 
actions  to  clear  $35  billion  in  undistributed  disbursements.  DFAS  gave  priority 
to  disbursing  hinds  and  moving  transactions  and  supporting  documentation 
throughout  the  system,  instead  of  analyzing  the  reasons  for  problems  and  taking 
action  to  correct  inefficiencies.  In  addition,  the  DFAS  Centers  had  not 
provided  Headquarters,  DFAS,  with  complete  and  accurate  data  on  the  stams  of 
undistributed  disbursements. 

o  Report  No.  93-133,  "Controls  Over  Operating  System  and  Security 
Software  Supporting  the  Defense  Finance  and  Accounting  Service,"  June  30, 
1993,  concluded  that  the  Defense  Information  Services  Organization  (DISO) 
information  processing  centers  at  Columbus  and  Dayton,  Ohio,  and  the  DSAC 
at  Colmnbus,  Ohio,  had  serious  problems  with  operating  system  and  security 
software  controls. 

o  Report  No,  92-076,  "Administration  of  the  Contract  Closeout  Process 
Within  DoD,"  April  15,  1992,  concluded  that  contracts  could  not  be  closed  out 
in  an  accurate  or  timely  manner  because  of  errors  in  MOCAS  data.  The  errors 
occurred  primarily  because  inexperienced  clerks  were  interpreting  and  entering 
data.  Although  DFAS  Columbus  Center  conducted  random  quality  assurance 
reviews  of  data  entry  transactions,  the  reviews  did  not  provide  adequate  controls 
or  validate  the  accuracy  of  appropriation  data. 

o  Report  No.  92-028,  "Merged  Accounts  at  the  Department  of 
Defense,"  December  30,  1991,  showed  that  DoD's  merged  accounts  contained 
more  than  $1.8  billion  in  unmatched  disbursements  and  $1  billion  in  negative 
unliquidated  obligations  (NULOs).  The  report  recommended  that  the 
Comptroller  of  the  Department  of  Defense  (now  die  Under  Secretary  of  Defense 
[Comptroller]),  require  the  Director,  DFAS,  to  emphasize  account  accuracy  in 
order  to  reduce  unmatched  disbursements  and  also  required  the  Director, 
DFAS,  to  formally  investigate  all  overdisbursed  appropriations  and  then- 
subaccounts  in  order  to  resolve  potential  violations  of  the  Antideficiency  Act. 
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Part  n  -  Findings  and  Recommendations 


Finding  A.  Controls  Over  Automated 
Data  Input 

Mechanization  of  Contract  Administration  Services  (MOCAS)  controls 
over  automated  data  input  were  not  adequate  to  prevent,  detect,  or 
correct  erroneous  and  duplicate  data  entry  by  personnel  at  the  DFAS 
Columbus  Center.  For  57  of  the  484  fields  tested,  MOCAS  edit  and 
validation  routines  accepted  invalid  data,  and  the  DFAS  Columbus 
Center  was  not  using  edit  and  validation  tables  available  from  the 
Military  Departments  (MILDEPs)  that  could  significantly  improve  the 
accuracy  of  MOCAS  data.  Although  desk  procedures  at  the  DFAS 
Columbus  Center  specified  the  criteria  for  data  to  be  entered  into  the 
fields,  the  actual  MOCAS  edits  did  not  prevent  entries  that  did  not  meet 
those  criteria.  Until  these  conditions  are  corrected,  the  DFAS  Columbus 
Center  will  continue  to  have  problems  with  negative  unliquidated 
obligations  (NULOs),  unmatched  disbursements,  and  incorrect  and 
duplicate  payments.  Also,  incorrect  accounting  data  will  remain 
undetected  and  will  be  returned  to  the  responsible  MILDEP  accountable 
stations. 


Background 


DoD  Directive  7220.9-M.  DoD  Directive  7220.9-M,  "DoD  Accounting 
Manual,"  currently  being  revised,  prescribes  internal  control  techniques  that  are 
to  be  designed  and  implemented  for  all  DoD  operating  accounting  systems.  The 
Directive  requires,  in  part,  that  accounting  systems  shall  contain  internal 
controls  that  prevent,  detect,  and  correct  errors  and  irregularities  that  may  occur 
at  any  point  between  authorizing  transactions  and  issuing  reports.  The  controls 
should  cover  the  functions  of  authorization  and  approval  of  transactions; 
preparation,  validation,  input,  communications,  processing,  storage,  and  output 
of  data;  error  resolution  and  data  reentry;  and  quality  maintenance  of  files  and 
databases.  The  Directive  also  contains  the  following  requirements. 

o  Internal  controls  shall  provide  reasonable  assurance  that  the  recording, 
processing,  and  reporting  of  financial  data  are  properly  performed  and  that  the 
completeness  and  accuracy  of  authorized  transactions  and  data  are  ensured 
during  automated  or  manual  accounting  functions. 

o  Input  controls  shall  detect  incomplete,  duplicate,  or  otherwise 
erroneous  transactions  and  ensure  that  they  are  corrected. 

o  The  accounting  system  shall  include  controls  that  prevent  or  detect 
incorrect  or  incomplete  recording  of  transactions,  duplicate  recording  of 
transactions,  entry  of  incorrect  data,  and  unauthorized  entry  to  systems  and 
files. 
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Desk  Procedures.  At  the  DFAS  Columbus  Center,  desk  procedures  201,  202, 
301,  and  302  identify  the  data  entry  screens  that  should  be  used  to  enter  contract 
and  disbursement  data  into  the  MOCAS  system.  For  most  of  the  data  entry 
fields  on  each  screen,  the  desk  procedures  specify  the  type  of  data  (such  as  all 
alpha  characters  or  all  numeric  characters)  to  be  entered  into  each  field. 

Test  Methodology.  Since  the  MOCAS  system  has  no  built-in  test  capabilities, 
we  used  the  MOC-F  testing  database  to  test  the  MOCAS  edit  and  validation 
routines.  The  MOC-F  is  owned  and  maintained  by  DSAC  and  is  identical  to  the 
MOCAS  production  system  (including  overnight  batch  processing  and 
reporting). 

We  initially  reviewed  screens  that  DFAS  Columbus  Center's  desk  procedures 
had  identified  for  entry  of  contract  data  and  selected  a  total  of  484  fields  to  be 
tested.  We  designed  623  tests  for  the  484  data  entry  fields  and  attempted  to 
enter  unacceptable  data  into  each  of  the  fields  tested. 

During  each  test,  we  entered  invalid  contract  data  into  a  field  on  a  particular 
screen  for  the  specific  field  being  tested.  For  all  other  fields  on  that  screen 
(fields  that  were  not  being  tested),  we  entered  valid  data.  We  considered 
automated  controls  over  a  particular  field  to  be  inadequate  if  MOCAS  accepted 
data  that  did  not  meet  the  requirements  of  desk  procedures. 

Following  initial  edits  at  the  point  of  data  entry,  MOCAS  performed  a  summary 
edit  on  the  fields  before  accepting  the  data.  During  this  process,  some  of  the 
invalid  data  entries  were  highlighted  as  "acceptable  errors"  or  were  rejected. 

To  ensure  that  no  further  MOCAS  edits  or  validation  routines  would  identify 
and  reject  the  invalid  entries,  we  subjected  the  data  to  MOCAS  overnight  batch 
processing.  The  overnight  batch  processing  contained  additional  edits  and 
validation  routines  designed  to  detect  and  prevent  invalid  transactions  from 
being  accepted  into  MOCAS.  All  invalid  entries  that  were  identified  and 
rejected  during  initial  data  entry,  summary  edit,  or  overnight  batch  processing 
were  considered  to  have  been  adequately  controlled.  Following  our  tests,  we 
met  with  personnel  at  the  DFAS  Columbus  Center  to  validate  each  undetected 
erroneous  entry. 


Controls  Over  Automated  Data  Input 


MOCAS  controls  over  automated  data  input  were  not  adequate  to  prevent, 
detect,  and  correct  erroneous  and  duplicate  data  entry  by  personnel  at  the  DFAS 
Columbus  Center.  For  57  of  the  484  fields  tested  (65  of  the  623  actual  tests 
performed),  MOCAS  edit  and  validation  routines  accepted  invalid  data.  Edit 
and  validation  tables  available  from  the  MILDEPs  could  have  significantly 
improved  the  accuracy  of  MOCAS  data  and  corrected  many  deficiencies,  but 
these  tables  were  not  used.  Appendix  A  gives  additional  information  on  the 
57  fields  and  65  tests  in  which  invalid  data  were  accepted. 
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Edit  and  Validation  Routines.  In  65  of  the  623  tests,  MOCAS  edit  and 
validation  routines  accepted  invalid  data.  In  each  test,  the  system  accepted 
unallowable  data  (such  as  alpha  instead  of  numeric  characters  or  vice  versa,  and 
illogical  data),  and  the  data  were  not  rejected  during  initial  entry,  summary  edit, 
or  overnight  batch  processing. 

For  example,  we  entered  an  obligation  amount  for  a  contract;  the  amount 
exceeded  the  contract  ceiling  price.  The  MOCAS  summary  edit  identified  this 
entry  as  an  "acceptable  error"  in  balancing,  which  might  require  subsequent 
research  to  determine  whether  a  correction  was  needed.  However,  the  entiy 
was  accepted,  and  no  immediate  correction  was  required.  The  IG,  DoD,  Audit 
Report  No.  94-054  had  found  a  95-percent  probability  that  at  least  22.6  percent 
(3,779)  of  the  16,742  high-dollar,  multiple-appropriation  contracts  in  MOCAS 
contained  at  least  1  error  in  obligation  amoimts.  Allowing  obligation  amounts 
to  exceed  contract  ceiling  prices  forther  weakens  the  accuracy  of  MOCAS  data. 

The  DFAS  Columbus  Center  also  had  problems  with  the  codes  for  fiscal  station 
numbers  and  general  operating  agency  codes  for  Army  appropriations.  Army 
regulations  list  the  fiscal  station  number  code  and  the  corresponding  general 
operating  agency  code  that  must  be  used  for  each  appropriation.  When  we 
entered  a  valid  fiscal  station  number  and  an  invalid  general  operating  agency 
code,  MOCAS  accepted  the  entry.  DFAS  Columbus  Center  personnel  agreed 
that  these  data  would  result  in  unmatched  disbursements  when  sent  to  Army 
accountable  stations. 

Edit  and  Validation  Tables.  Edit  and  validation  tables  were  available  from  the 
MILDEPs;  these  tables  could  have  significantly  improved  the  accuracy  of 
MOCAS  data  but  were  not  being  used.  Each  MILDEP  has  its  own  edit  and 
validation  tables;  if  installed  in  MOCAS,  these  tables  could  prevent  many  errors 
in  accounting  data. 

For  example,  the  Army  Data  Element  Management  Accounting  Reporting 
system  for  expenditures  uses  the  Accounting  Table  Maintenance  system  to  edit 
data  transferred  to  Data  Element  Management  Accounting  Reporting  from 
various  disbursing  and  fiscal  stations.  The  edits  include  fields  such  as  the 
general  operating  agency,  allotment  serial  number,  and  program  element  or 
budget  project. 

The  Navy's  Centralized  Master  Edit  Table  contains  additional  edits  to  ensure 
that  correct  accounting  data  are  entered  into  Navy  accounting  systems.  If  used 
by  the  DFAS  Columbus  Center,  the  Centralized  Master  Edit  Table  could 
perform  edits  that  are  not  available  in  MOCAS,  on  fields  such  as  the  limit 
subhead,  bureau  control  number,  and  fiscal  station  number. 

The  Air  Force  has  similar  tables.  The  Air  Force's  Master  Appropriation 
Reporting  Tables  contain  eight  database  files  that  perform  a  variety  of  edits  and 
validations  of  Air  Force  appropriations. 

The  IG,  DoD,  Audit  Report  No.  94-054  found  a  95-percent  probability  that  at 
least  39.2  percent  (6,559  contracts)  of  the  16,742  high-dollar,  multiple- 
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appropriation  contracts  in  MOCAS  contained  1  or  more  errors  in  their 
accounting  data  entries.  Considering  this  volume  of  errors,  automated  edits 
should  be  used  whenever  possible  in  order  to  improve  data  accuracy. 

The  managers  we  contacted  generally  agreed  that  using  edit  and  validation 
tables  available  from  the  MILDEPs  might  improve  the  accuracy  of  MOCAS 
data.  However,  the  DFAS  had  not  evaluated  the  feasibility  and  cost- 
effectiveness  of  using  those  tables. 


Conclusion 


Automated  edit  and  validation  routines  could  be  used  to  make  MOCAS  data 
more  accurate.  MOCAS  controls  over  automated  data  entry  were  not  adequate 
to  prevent,  detect,  and  correct  erroneous  and  duplicate  data  entered  by 
personnel  at  the  DFAS  Columbus  Center.  Until  these  conditions  are  corrected, 
problems  widi  NULOs,  unmatched  disbursements,  and  incorrect  and  duplicate 
payments  will  continue.  Incorrect  accounting  data  will  remain  undetect^  and 
will  be  sent  back  to  the  MILDEP  accountable  stations,  causing  unmatched 
disbursements. 


Recommendations,  Management  Comments,  and 
Audit  Response 


1.  We  recommend  that  the  Director,  Defense  Finance  and  Accounting 
Service  Columbus  Center: 

a.  Install  the  Army's  Data  Element  Management  Accounting 
Reporting  table,  ttie  Navy's  Centralized  Master  Edit  Table,  and  the  Air 
Force's  Master  Appropriation  Reporting  Tables  in  the  Mechanization  of 
Contract  Administration  Services  system  to  improve  data  accuracy. 

DFAS  Comments.  The  Deputy  Comptroller  of  the  Department  of  Defense 
(Financial  Systems),  re^nding  to  recommendations  made  to  the  DFAS, 
partially  concurred,  stating  that  DFAS-Columbus  will  contact  the  Milit^ 
Dq>artments  to  explore  the  feasibility  of  obtaining  the  edit  tables  for  installation 
into  MOCAS,  develop  and  submit  requirements  to  the  MOCAS  Central  Design 
Activity  for  cost  estimates  of  the  programming  changes,  and  submit  the  system 
change  request  to  Headquarters,  DFAS,  for  approval  and  inclusion  in  the 
project  development  plan.  Considering  the  size  of  the  edit  tables  and  the  need 
to  expand  the  current  MOCAS  database  and  table  files  to  accommodate  them, 
the  determination  as  to  whether  to  add  the  tables  to  MOCAS  will  be  based  on 
the  success  of  the  payment  prevalidation  process  currently  underway  at  DFAS 
Columbus  Center  versus  the  cost  to  progr^  the  tables  into  MOCAS.  The 
complete  text  of  management's  comments  is  in  Part  IV. 
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Audit  Response.  Management's  agreement  to  develop  a  system  chpge 
proposal  is  partially  responsive.  We  agree  that  programming  the  Military 
Department  edit  tables  into  MOCAS  and  expanding  the  current  database  and 
table  ^es  may  involve  considerable  costs.  Manually  prevalidating  all  payments 
of  $1  million  or  more,  which  we  fully  support  as  a  stopgap  measure,  may  also 
ent^  significantly  increased  costs  and  those  costs  could  be  less  visible.  Unless 
all  payments,  regardless  of  size,  are  prevalidated,  improper  payments  and 
accounting  errors  will  continue  and  an  accurate  database  will  not  be  achieved. 
TTie  only  means  to  ensure  overall  payment  accuracy  is  to  improve  the  automated 
accounting  systems,  building  in  vmid  edit  checks. 

We  request  that  management  comments  on  this  final  report  specify  what  factors 
will  be  considered  in  evaluating  the  manual  prevalidation  effort  as  an  alternative 
to  MOCAS  improvements  and  what  will  be  done  to  address  payments  under 
$1  million. 


b.  Establish  automated  edit  and  validation  controls  for  data  input 
fields  that  accepted  invalid  data. 

DFAS  Comments.  The  Deputy  Comptroller  (Financial  Systems)  partially 
concurred,  stating  that  DoD  Directive  7220.9-M,  DoD  Accounting  Manual, 
prescribes  that  accounting  systems  "shall  be  flexible  enough  to  handle  additions 
or  deletions,  including  changes  to  accounts  or  account  codes,  classifications, 
organizations,  and  dollar  thresholds,  without  extensive  program  or  system 
changes."  Many  MOCAS  fields  identified  in  the  draft  report  as  having 
inadequate  automated  edit  or  validation  controls  were  programmed  with 
minimal  validations  to  provide  flexibility  for  future  changes.  However, 
management  agreed  that  additional  edits  and  validations  may  be  needed  for 
several  fields  and  stated  that,  for  those  fields,  they  would  review  and  implement 
system  changes  as  appropriate. 

Audit  Response.  While  we  agree  that  additional  automated  edits  and 
validations  may  not  be  cost-effective  or  otherwise  justifiable  for  all  57  fields 
cited  in  this  report,  in  at  least  some  cases  they  are  critically  needed.  For 
example,  allowing  individual  obligation  amounts  to  exceed  a  contract's  to^ 
ceiling  price  significantly  weakens  the  accuracy  of  MOCAS  data  and  can  easily 
result  in  eventual  overdisbursements,  unmatched  disbursements,  and  other 
problems.  To  enable  us  to  fully  evaluate  management’s  response,  the  Deputy 
Comptroller  (Financial  Systems)  is  requested  to  provide  specifics  as  to  which 
fields  will  or  will  not  be  further  review^  for  possible  additional  automated  edits 
and  validations  and  the  rationale  for  these  determinations.  We  request  that 
management  provide  this  additional  information  when  responding  to  the  final 
report. 
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Responses  to  the  final  report  are  required  firom  the  Depu^  Comptroller  of  the 
D^irtment  of  Defense  (Financial  Systems)  for  the  items  indicated  with  an  "X" 
in  Ae  chart  below. 


Number 


Concur/ 


Proi^sed  Completion  Related 
Actions  Date  ISStiSS 


l.a.,  l.b. 


X 
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Finding  B.  Controls  Over  Rejected 
Transactions 

The  DFAS  Colxraibus  Center's  controls  over  rejected  MOCAS  data  were 
not  adequate  to  ensure  that  the  data  were  properly  managed,  corrected, 
and  reentered  accurately  and  promptly.  Specifically,  die  3  Contract 
Administration  Services  Directorates  and  their  16  payment  divisions  did 
not  use  automated  reject  listings  consistently,  data  entry  supervisors  did 
not  review  and  document  data  corrections,  and  rejects  were  not  tracked 
by  numbers  and  categories  of  errors.  These  conditions  occurred  because 
the  DFAS  Columbus  Center  did  not  have  adequate  desk  operating 
procedures  or  other  guidance  specifying  the  MOCAS  reject  listings  that 
should  be  used  and  how  corrections  should  be  processed  and  verified. 
As  a  result,  for  the  276  transactions  we  reviewed  that  were  rejected  in 
November  1993,  92  transactions  were  not  promptly  and  accurately 
corrected  and  reentered  into  MOCAS. 


Background 


DoD  Directive  7220.9-M.  DoD  Directive  7220. 9-M,  "DoD  Accounting 
Manual"  (the  DoD  Accounting  Manual),  currently  being  revised,  prescribes 
internal  control  techniques  that  are  to  be  designed  and  implemented  into  all  DoD 
operating  accounting  systems.  The  Directive  requires,  in  part,  that  accounting 
systems  shall  include  procedures  for  controlling  errors.  These  procedures 
should  ensure  that  when  errors  are  detected,  they  are  corrected  promptly  and 
reentered  into  the  appropriate  processing  cycle  and  that  corrections  are  made 
only  once  and  are  validated.  Alfliough  the  DoD  Accounting  Manual  does  not 
give  a  standard  for  timely  correction  of  errors,  the  General  Accounting  Office 
has  stated  that  24  hours  is  the  ideal.  However,  variations  from  the  GAO 
standard  may  be  acceptable  when  work  load  and  other  factors  are  taken  into 
account.  Therefore,  we  considered  corrections  to  be  timely  if  made  within 
72  hours  or  3  working  days  after  the  DFAS  Columbus  Center  was  notified  of  an 
error. 

The  DoD  Accounting  Manual  also  states  that: 

0  when  data  input  errors  occur,  error  lists  or  reports  shall  be  prepared  to 
show  why  each  item  was  rejected  and  open  items  shall  be  tracked  and  aged  until 
all  errors  are  corrected; 

o  accounting  systems  shall  provide  management  with  reports  that  list 
errors,  reasons  for  errors,  and  corrective  actions  taken; 

0  supervisors  or  lead  personnel  shall  review  error  processing  and  lists  of 
errors  and  corrections;  and 
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o  procedures  shall  be  established  for  periodic  analysis  of  the  reasons  for 
errors  and  rejected  transactions,  by  type  and  source,  so  that  corrective  actions 
can  be  taken. 

DLA  Manual  7000.5  Chapter  16.  Defense  Logistics  Agency  Manual  7000.5, 
chapter  16,  April  1987,  "Contract  Administration  Services  Accounting 
Procedures,"  contains  guidance  for  the  content  and  use  of  MOCAS  reports.  It 
gives  management  and  functional  users  a  description  of  the  system's 
capabilities,  output  products,  and  input  requirements  and  includes  directions  for 
processing  and  correcting  errors. 

Reject  Listings.  Reject  listings  are  MOCAS-generated  reports  that  identify 
erroneous  data  entries  that  passed  MOCAS 's  edit  and  validation  routines,  but 
were  identified  as  incorrect  during  overnight  batch  processing.  During  batch 
processing,  additional  edits  are  done  to  ensure  that  incorrect  data  accepted 
earlier  are  identified  and  corrected. 

Accounting  Classification  Reference  Number.  The  accounting  classification 
reference  number  (ACRN)  is  a  two-character  reference  used  throughout  DoD  to 
identify  accounting  data  during  the  obligation,  payment,  and  disbursement  of 
funds  on  a  contract.  ACRNs  allow  accounting  activities  to  collect  and  record, 
in  one  step,  all  applicable  financial  information  in  each  line  of  accounting  data. 


Controls  Over  Rejected  Transactions 


The  DFAS  Columbus  Center's  controls  over  rejected  MOCAS  data  were  not 
adequate  to  ensure  that  data  were  properly  managed,  corrected,  and  reentered  in 
a  timely  manner.  Specifically,  the  3  CAS  Directorates  and  their  16  contract 
payment  divisions  did  not  use  automated  reject  listings  consistently;  data  entry 
supervisors  did  not  review  and  document  data  corrections;  and  rejects  were  not 
tracked  by  numbers  and  categories  of  errors. 

Data  Corrections.  We  nonstatistically  selected  276  transactions  from  11  of  the 
numerous  reject  listings  provided  to  the  three  Columbus  Center  CAS 
directorates.  Of  the  276  rejected  transactions  we  reviewed,  92  were  not 
corrected  and  reentered  accurately  or  promptly.  Of  the  92  rejected  transactions 
(shown  on  1 1  nonstatistically  selected  reject  listings  from  November  2  through 
November  23,  1993),  57  transactions  were  not  corrected  accurately  and 
promptly,  and  35  were  corrected  accurately  but  not  promptly.  Corrections 
required  up  to  204  days  after  the  errors  were  found.  Appendix  B  gives 
additional  details  of  these  92  transactions. 

For  example,  contract  DAAE07-92-C-R007  appeared  on  a  reject  listing  for 
November  15,  1993,  because  an  incorrect  appropriation  number,  which  did  not 
appear  on  the  MOCAS  master  appropriation  file,  was  used.  In  this  case,  an 
Amy  appropriation  was  entered;  a  DLA  appropriation  should  have  been  entered 
instead.  To  pay  a  $520  invoice  on  this  contract,  personnel  at  the  DFAS 
Colmnbus  Center  created  a  dummy  ACRN  of  XI  and  paid  the  invoice  on 
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December  2,  1993.  As  of  May  2,  1994,  the  appropriation  error  and  dummy 
ACRN  had  not  been  corrected  and  almost  $23,000  in  additional  payments  had 
been  made  against  ACRN  XI . 

Use  of  Automated  Reject  Listings.  The  3  CAS  Directorates  and  their 
16  payment  divisions  did  not  use  die  automated  reject  listings  consistently. 
Because  of  inadequate  desk  procedures  at  the  DFAS  Columbus  Center,  the  CAS 
Directorates  and  payment  divisions  were  allowed  to  decide  which  reject  listings 
to  use.  In  addition,  supervisors  in  the  payment  divisions  established  their  own 
procedures  for  correcting  errors. 

For  example.  Report  UNFB  500A  (the  Duplicate  Payment  Report)  was 
routinely  used  by  only  2  of  the  CAS  Directorates  and  13  of  the  two  CAS 
Directorates'  14  payment  divisions.  The  Southern  CAS  Directorate  and  its  two 
payment  divisions  did  not  use  the  report.  Likewise,  Report  WYFD  bOOA  (the 
Duplicate  Invoice  Report)  was  routinely  used  by  only  13  of  the  16  payment 
divisions  at  the  DFAS  Columbus  Center.  Appendix  C  identifies  the  reject 
listings  used  and  the  CAS  Directorates  and  payment  divisions  that  used  them. 

Supervisory  Reviews  of  Data  Corrections.  Data  entry  supervisors  at  the 
DFAS  Columbus  Center  did  not  adequately  review  data  corrections  or  document 
their  reviews.  Of  the  seven  desk  procedures  we  reviewed,  only  two  procedures 
mentioned  supervisory  reviews  of  data  corrections.  The  supervisors  who  said 
they  reviewed  corrections  and  maintained  logs  could  not  provide  any 
documentation  to  show  that  the  reviews  were  actually  performed,  when  they 
were  performed,  or  what  corrective  actions  were  taken. 

Tracking  and  Analysis  of  Rejected  MOCAS  Tranpctions.  The  DFAS 
Columbus  Center  did  not  maintain  reject  listings  and  did  not  track  or  analyze 
rejected  data  by  types  and  categories  of  errors.  Periodic  analysis  of  the  reasons 
for  errors  and  rejected  transactions,  by  type  and  source,  could  help  managers 
identify  actions  to  improve  data  accuracy.  For  example,  managers  could 
identify  data  entry  clerks  working  in  the  payment  divisions  who  made  more 
errors  than  the  average;  these  employees  could  be  given  additional  training  or 
transferred  to  positions  that  did  not  involve  data  entry. 


Causes  of  Inadequate  Controls  Over  Rejected  MOCAS  Data 

The  inadequate  controls  over  rejected  MOCAS  data  had  several  causes: 

o  inadequate  guidance  on  reject  listings  that  should  be  used  by  the  CAS 
Directorates  and  payment  divisions  at  the  DFAS  Columbus  Center, 

o  a  lack  of  current  desk  procedures  for  correcting  reject  listings  and 
documenting  corrections,  and 

o  no  clear  guidance  for  supervisors  on  how  to  review  and  verify 
corrections. 
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At  the  DFAS  Columbus  Center,  supervisors  also  were  not  required  to 
periodically  analyze,  by  type  and  source,  the  reasons  for  errors  and  rejected 
transactions,  so  that  ways  to  improve  data  accuracy  could  be  identified. 

Guidance  in  DLA  Manual  7000.5.  Although  DLA  Manual  7000.5, 
chapter  16,  provides  overall  guidance  on  the  content  and  use  of  MOCAS 
reports,  including  the  processing  of  error  corrections,  it  does  not  identify  the 
error  listings  that  all  CAS  Directorates  and  payment  divisions  should  use.  The 
DFAS  Columbus  Center  also  had  not  issued  guidance  on  how  errors  were  to  be 
corrected  and  documented;  data  entry  supervisors  at  the  DFAS  Columbus 
Center  established  their  own  procedures.  Consequently,  the  CAS  Directorates 
and  payment  divisions  decided  which  reject  listings  to  use  and  how  to  use  them. 

Desk  Procedures.  The  DFAS  Columbus  Center's  desk  procedures  should  have 
included  guidance  on  how  to  use  the  reject  listings.  However,  the  desk 
procedures  were  outdated  and  unclear,  which  contributed  to  the  problem.  Of 
the  11  reject  listings  we  reviewed,  only  4  had  clear  and  current  desk  procedures. 
Desk  procedures  for  five  reject  listings  were  not  adequate  to  ensure  that 
corrections  were  promptly  and  accurately  processed,  and  desk  procedures  did 
not  exist  for  the  other  two  reject  listings.  Appendix  D  lists  the  desk  procedures 
we  reviewed  and  the  problems  fovmd. 

A  more  serious  problem  was  that  most  desk  procedures  did  not  require 
supervisors  to  review  reject  listings  or  error  corrections.  DoD 
Directive  7220.9-M  requires  supervisors  or  lead  personnel  to  review  reject 
listings  and  error  corrections;  however,  of  the  11  desk  procedures  we  reviewed, 
only  desk  procedures  608  and  801  mentioned  the  need  for  supervisors  to  review 
reject  listings.  The  data  entry  supervisors  we  contacted  said  they  maintained 
error  logs  and  periodically  reviewed  error  corrections;  however,  none  of  these 
supervisors  could  provide  any  documentation  to  show  that  the  reviews  were 
actually  performed,  when  they  were  performed,  or  what  corrections  were  made 
as  a  result. 

Periodic  Analysis  of  Errors.  Managers  at  the  DFAS  Columbus  Center  did  not 
track  and  periodically  analyze  errors  and  rejected  transactions  by  type  and 
source,  and  supervisors  could  not  identify  the  most  common  problems  or  state 
whether  corrective  actions  had  been  taken.  By  failing  to  record  this 
information,  managers  were  not  using  all  available  means  of  improving  data 
accuracy. 


Conclusion 


Of  the  276  rejected  transactions  we  reviewed,  92  transactions  were  not  corrected 
and  reentered  promptly  and  accurately.  This  situation  occurred  because  of 
inadequate  controls  over  the  correction  and  reentry  of  rejected  MOCAS  data. 
This  condition  made  MOCAS  data  less  accurate  and  contributed  to  the  DFAS 
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Columbus  Center's  recurring  problems  with  duplicate  payments,  NULOs, 
incorrect  progress  payments,  and  improper  payment  and  closure  of  completed 
contracts. 


Recommendations,  Management  Comments,  and 
Audit  Response 


We  recommend  that  the  Director,  Defense  Finance  and  Accounting  Service, 
Columbus  Center: 

1.  Issue  speciDc  instructions  to  the  Contract  Administration  Services 
Directorates  and  their  payment  divisions  on  which  reject  listings  from  the 
Mechanization  of  Contract  Administration  Services  system  are  critical  and 
how  these  reject  listings  should  be  used. 

DFAS  Comments.  The  Deputy  Comptroller  of  the  Department  of  Defense 
(Financial  Systems),  responding  to  recommendations  made  to  the  DFAS, 
concurred,  stating  that  specific  instructions  on  which  reject  listings  from  the 
MOCAS  system  are  critical  and  how  the  listings  should  be  used  will  be 
provided  in  the  revisions  to  the  desk  procedures  (expected  to  be  completed  by 
December  31,  1994).  Additionally,  periodic  internal  reviews  will  be  conducted 
to  ensure  compliance  with  desk  procedures.  The  complete  text  of 
management's  comments  is  in  Part  IV. 

2.  Direct  that  errors  in  data  entry  be  corrected  for  the  92  cases 
discussed  in  this  report. 

DFAS  Comments.  The  Deputy  Comptroller  (Financial  Systems)  concurred, 
stating  that  errors  in  data  entry  for  the  92  cases  discussed  in  this  report  will  be 
corrected  by  November  30,  1994. 

3.  Require  data  entry  supervisors  to: 

a.  review  reject  listings  produced  by  the  Mechanization  of 
Contract  Administration  Services  system, 

b.  identify  data  errors  that  need  correction,  and 

c.  document  their  reviews. 

DFAS  Comments.  The  Deputy  Comptroller  (Financial  Systems)  concurred, 
stating  that  requirements  for  supervisor/lead  review,  identification,  and 
documentation  will  be  in  the  previously  mentioned  revisions  to  desk  procedures 
to  be  completed  by  December  31,  1994. 

4.  Rewrite  desk  procedures  301,  608,  and  801  for  the  five  reject 
Listings  discussed  in  this  report  (see  Appendix  D)  to  give  specific  guidance 
on  the  use  of  reject  listings  and  procedures  for  error  correction. 
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DFAS  Comments.  The  Deputy  Comptroller  financial  Systems)  concurred, 
stating  that  specific  instructions  on  the  up  of  reject  listings  and  procedures  for 
error  corrections  will  be  in  the  revisions  to  the  desk  procMures.  Desk 
Procedures  301  and  801  are  being  revised.  All  revisions  to  Desk 
Procedures  301,  608,  and  801  are  expected  to  be  completed  by  December  31, 
1994. 


5.  Bnplanent  desk  procedures  for  the  two  reject  listings  discussed  in 
this  report  (see  Appendk  D)  for  which  no  procedures  currently  exist.  At  a 
minimum,  the  procedures  should  give  specific  guidance  on  the  use  of  reject 
listings  and  procedures  for  error  correction. 

DFAS  Comments.  The  Deputy  Comptroller  financial  Systems)  concurred, 
stating  that  Desk  Procedure  703  provides  guidance  on  the  use  of  report 
UNPA3S0J,  and  Desk  Procedure  602  revisions  will  include  guidance  on  the  use 
of  report  MNMA180A.  The  desk  procedures  are  to  be  completed  by 
December  31,  1994. 

6.  Require  supervisors  to  continuously  monitor  rejected  transactions 
by  numbers  and  categories  of  errors,  bi  addition,  direct  the  Quality 
A^rance  Division  to  periodically  monitor  rejected  transactions  using  valid 
statistical  sampling  tec&iiques  to  identify  common  errors  in  data  entry  and 
areas  where  data  accuracy  can  be  improved. 

DFAS  Comments.  The  Deputy  Comptroller  (Financial  Systems)  papally 
concurred,  stating  that  tracking  reject  transactions  by  numbers  and  categories  of 
errors  would  be  an  inefficient  use  of  resources.  Revisions  to  desk  procedures 
will  provide  for  supervisory  monitoring  of  data  errors.  In  addition,  die  Quality 
Assurance  Division  will  periodically  monitor  rejected  transactions  using 
sampling  techniques  to  identify  common  errors  in  data  entry  and  areas  where 
data  accuracy  can  be  improved. 

• 

Audit  Response.  We  consider  management's  comments  to  these 
recommendations  responsive.  We  do  not  necessarily  agree  with  management's 
assertion  that  tracking  reject  transactions  by  numbers  and  categories  of  errors 
would  be  an  inefficient  use  of  resources  since  this  method  can  easily  be 
accomplished  using  available  automated  capabilities.  However,  the  alternative 
actions  proposed  by  management  should  correct  the  problems  identified  as  long 
as  valid  statistical  sampling  techniques  are  used  by  Quality  Assurance  Division 
personnel.  Therefore,  we  revised  our  recommendation  accordingly  and  request 
no  further  comments. 
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Access  controls  for  the  Mechanization  of  Contract  Administration 
Services  (MOCAS)  system  were  not  adequate  to  prevent  unauthorized 
users  from  accessing  the  system.  Specifically,  user  identification  codes 
(user  IDs)  for  former  employees  of  &e  DFAS  Columbus  Center,  as  well 
as  for  current  employees  who  no  longer  required  access  to  MOCAS, 
were  not  canceled  promptly.  This  condition  occurred  because  Terminal 
Area  Security  Officers  (TASOs)  did  not  have  guidelines  for  the 
termination  of  user  IDS  and  because  the  MOCAS  access  listings  were 
not  periodically  reviewed  to  ensure  that  only  valid  users  maintained 
access.  As  a  result,  for  66  (10  percent)  of  the  658  employees'  files  we 
reviewed  at  DFAS  Columbus  Center,  user  IDs  were  no  longer  required 
and  should  have  been  terminated.  Failure  to  promptly  terminate  user 
IDs  increased  the  potential  for  unauthorized  changes  to  MOCAS  data. 


Background 


DoD  Directive  7220.9-M.  DoD  Directive  7220.9-M,  "DoD  Accounting 
Manual"  (the  DoD  Accounting  Manual),  currently  being  revised,  prescribes 
internal  control  techniques  that  are  to  be  designed  and  implemented  for  all  DoD 
operating  accounting  systems.  The  DoD  Accounting  Manual  requires,  in  part, 
that  accounting  systems  shall  include  controls  that: 

o  prevent  or  detect  the  processing  of  tmauthorized  or  incorrect  data, 

o  prevent  accounts,  master  files,  and  databases  from  being  changed 
without  authorized  transactions,  and 

o  prevent  unauthorized  entry  to  systems  and  files. 

DLA  Regulation  5200.17.  Defense  Logistics  Agency  Regulation  5200.17, 
"Security  Requirements  for  Automated  Information  and  Telecommunications 
Systems,"  October  9,  1991,  is  the  DFAS  Columbus  Center's  security  guidance. 
DLA  Regulation  5200. 17  directs,  in  part,  that  requirements  for  user  access  will 
be  validated  at  least  semiannually  to  ensure  that  the  requirements  are  current  and 
accurate.  Validations  should  he  performed  continuously  so  that  the  user 
population  is  always  under  review,  and  records  of  the  reviews  should  be 
maintained  for  3  years.  DLA  Reflation  5200.17  also  requires  custodians  of 
data  to  develop  access  policies  that  identify  users'  needs  and  to  apply  safeguards 
so  that  only  authorized  persons  have  access  to  data. 

Terminal  Area  Security  Officers.  Terminal  Area  Security  Officers  (TASOs) 
at  the  DFAS  Columbus  Center  assist  Information  Systems  Security  Officers  at 
the  Defense  Information  Systems  Organization  (DISO)  in  ensuring  that  remote 
terminals  comply  with  security  procedures.  The  TASOs  also  request  user  IDs 
and  passwords  for  personnel  at  DFAS  Columbus  Center  and  request  termination 
of  user  IDs  and  passwords  that  are  no  longer  needed. 
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User  IDs.  Personnel  at  DFAS  Columbus  Center  who  require  access  to  MOCAS 
are  assigned  user  IDs.  By  combining  the  user  IDs  and  individual  passwords 
employees  can  access  specific  MOCAS  screens  to  read,  update,  or  delete  data’ 
d^ndmg  on  their  validated  needs.  We  did  not  review  password  controls’ 
which  were  the  subject  of  IG,  DoD,  Report  No.  94-060,  "General  Controls  for 
Computer  Systems  at  the  Information  Processing  Centers  of  the  Defense 
Information  Services  Organization,"  March  18,  1994.  The  report  stated  that 
psswords  were  not  being  changed  in  a  timely  manner.  We  verified  that  DISO 
had  impleinented  om  recommendation  by  installing  the  Automated  Password 

J  required  user  passwords  to  be  changed  every  90  days  on 

all  MOCAS  databases.  o  j  j 

Audit  I^oc^ures.  Our  review  of  user  IDs  was  based  on  the  "Total 

formation  System  Extended  Security  System  Batch  Utilities  Application  to 

User  Relationship  Report"  (the  TIS  report).  The  TIS  report  is  a  computerized 

report  on  the  secunty  of  MOCAS  terminals;  it  identifies  all  MOCAS  input 

screens  by  screen  number,  identifies  the  users  who  have  access  to  each  screen 

perform  our  review,  we  used  nonstatisticai 

DFAS  rnhimhnfr  ^  ^  "e'^iewed  all 

Dh AS  Columbus  Center  users  who  had  access  to  these  screens.  These  screens 

flowed  users  to  change  existing  MOCAS  data  or  to  input  data  on  contractor 

invoice  and  disbursements.  We  then  identified  user  IDs  that  began  with  DDM 

w  were  DFAS  Columbus  Center  employees 

We  found  a  total  of  658  MOCAS  users  at  the  DFAS  Columbus  Center  who  had 

revfewed  ^  screens.  Appendix  E  lists  the  input  screens  we 


Access  Controls 


MOCAS  access  controls  were  not  adequate  to  prevent  unauthorized  users  from 
accessmg  the  system.  Of  the  658  DFAS  Columbus  Center  employees  whose 
user  IDs  we  reviewed,  66  employees  (10  percent)  were  authorized  to  access  the 
11  mput  screens,  although  they  no  longer  required  access;  their  user  IDs  should 
have  been  tennmted.  Of  these  66  user  IDs,  27  were  for  personnel  no  longer 
employed  by  the  DFAS  Columbus  Center  and  39  were  for  personnel  whose 
a^ess  requirements  Imd  changed.  Appendix  F  lists  unauthorized  user  IDs  and 
the  reasons  these  employees  no  longer  required  access. 

personnel  who  had  been  reassigned 
to  me  Stock  ^nd  Directorate  and  no  longer  required  access  to  MOCAS  Nine 
of  the  user  IDs  were  for  personnel  who  worked  in  me  Payroll  Commercial 

r A«^n-  Human  Resources  Directorates  instead 

of  me  CAS  Directorates;  mey  did  not  need  access  to  MOCAS.  The  remaining 
five  user  IDs  were  for  personnel  who  had  been  assigned  to  new  CAS 
Directorates  but  still  had  access  to  me  databases  in  me  CAS  Directorates  where 
mey  had  previously  worked.  Implementation  of  me  Automated  Password 


Finding  C.  Access  Control 


Change  Facility  does  not  prevent  unauthorized  access;  if  an  unauthorized 
employee's  user  ID  is  active,  the  employee  can  update  his  or  her  password 
every  90  days  and  continue  to  have  access  to  MOCAS. 


Causes  of  Inadequate  Access  Controls 


These  control  weaknesses  occurred  because  the  TASOs  did  not  receive  adequate 
guidance  on  when  and  how  user  IDs  should  be  canceled  and  did  not  regularly 
review  the  lists  of  users  with  access  to  MOCAS. 

TASO  Guidance.  Although  overall  control  of  MOCAS  access  is  DISO's 
responsibility,  the  TASOs  at  the  DFAS  Columbus  Center  did  not  receive 
guidance  on  when  and  how  user  IDs  should  be  canceled,  including  the  deadline 
for  cancellations.  During  our  audit,  however,  DISO  completed  a  draft 
handbook  containing  updated  guidance  for  TASOs;  this  handbook  should  be 
finalized  soon.  Therefore,  we  are  not  recommending  any  corrective  actions  in 
this  area. 

Reviewing  Lists  of  Users  with  Access  to  MOCAS.  TASOs  at  the  DFAS 
Columbus  Center  did  not  review  the  TIS  Report  at  least  semiannually.  If  they 
had  done  so,  invalid  user  IDs  and  inaccurate  information  could  have  been 
identified  and  corrected.  For  example,  because  the  same  name  could  be  spelled 
several  ways  and  first  and  last  names  were  sometimes  reversed,  some  users 
were  listed  more  than  once  (for  example,  a  user  could  be  listed  as  both  John 
Doe  and  Doe  John).  In  two  instances,  an  individual  had  two  different  user  IDs 
and,  in  another  instance,  two  individuals  had  the  same  user  ID. 


Conclusion 


Access  controls  for  MOCAS  were  not  adequate  to  prevent  unauthorized  users 
from  accessing  the  system.  Until  user  IDs  are  properly  managed  and 
controlled,  the  potential  will  exist  for  unauthorized  changes  to  be  made  in 
MOCAS  data. 


Recommendations,  Management  Comments,  and 
Audit  Response 


We  recommend  that  the  Director,  Defense  Finance  and  Accounting  Service 
Columbus  Center: 

1.  Terminate  the  user  identification  codes  for  the  66  employees 
discussed  in  this  report. 
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DFAS  Response.  The  Deputy  Comptroller  (Financial  Systems)  concurred, 
stating  that  the  unauthorized  user  identification  codes  in  the  draft  report  will  be 
reviewed  and  terminated  as  appropriate  by  December  31,  1994. 

2.  Direct  Terminal  Area  Security  Officers  at  the  Defense  Finance 
and  Accounting  Service  Columbus  Center  to: 

a.  Thoroughly  review  the  "Total  Information  System 
Extended  Security  System  Batch  Utilities  Application  to  User  Relationship 
Report"  for  all  input  screens  in  the  Mechanization  of  Contract 
Administration  Services  system. 

b.  Terminate  user  identification  codes  that  are  no  longer 

required. 


c.  Correct  all  errors  identified,  including  duplicate  user 
identification  codes,  reversals  of  first  and  last  names,  and  two  or  more 
employees  with  the  same  user  identification  code. 

DFAS  Response.  The  Deputy  Comptroller  (Financial  Systems)  concurred, 
stating  that  DFAS  Columbus  Center  is  ciurently  reviewing  access  control  in  the 
Contract  Entitlement  Directorate.  The  recommended  corrective  actions  will  be 
initiated  as  part  of  that  review. 

Audit  Response.  Our  recommendation  was  intended  to  encompass  DFAS 
Columbus  Center  in  its  entirety,  not  just  the  Contract  Entitlement  Directorate. 
Although  management  may  have  meant  that  these  corrective  actions  will  be 
initiated  throughout  DFAS  Columbus  Center,  the  response  does  not  clearly 
indicate  so.  We  request  that  management  provide  additional  clarification  on  this 
recommendation  when  responding  to  the  final  report. 

3.  Require  Terminal  Area  Security  Officers  to  conduct  semiannual 
reviews  of  the  list  of  user  identification  codes  and  document  these  reviews. 

DFAS  Response.  The  Deputy  Comptroller  (Financial  Systems)  concurred, 
stating  that  the  semiannual  reviews  will  begin  in  January  1995  and  will  be 
ongoing  after  that  date. 
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Response  Requirements  for  Each  Recommendation 

Responses  to  the  final  report  are  required  from  the  Depu^  Comptroller  of  the 
Dq)artmrat  of  Defense  (Financial  Systems)  for  the  items  indicated  with  an  "X" 
in  &e  chart  below. 


Resnonse  Should  Cover: 

Number 

Concur/ 

Nonconcur 

Proposed 

Actions 

Conipletion 

Date 

Relate^ 

Issues 

2.a.,  2.b,,  2.C. 

X 

X 

X 

IC 

*IC  =  Internal  control  weakness 
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Appendix  A.  Additional  Information  on 

57  MOCAS  Fields  with 
Inadequate  Controls 


Field  Name 

Screen 

Number 

Nature  of  Inadequate  Controls 

Type  of 

Contract  Code 

CTllOO 

MOCAS  accepted  data  in  this  field  on 
a  Basic  Ordering  Agreement  contract 
in  violation  of  DFAS  Columbus  Center 
desk  procedure  201. 

Discount 

Terms 

CT1200 

MOCAS  accepted  unreasonably  high 
discount  rates  in  this  field. 

International 
Balance  of 
Payments 
(IBOP) 

County  Code 

CT1200 

MOCAS  allowed  a  coimtry  code  in  this 
field,  although  the  IBOP  indicator  field 
was  blank.  This  entry  violates  DFAS 
Columbus  Center  desk  procedure  201. 
MOCAS  also  allowed  an  erroneous 
country  code  in  this  field. 

International 
Balance  of 
Payments 
Category 

Code 

CT1200 

MOCAS  allowed  an  alpha  character 
other  than  "C"  in  this  field.  Also,  on  a 
contract  for  which  DFAS  Columbus 
Center  desk  procedure  201  required  an 
entry  in  this  field,  MOCAS  allowed 
the  field  to  be  left  blank. 

Guaranteed 

Maximum 

Shipping 

Weight/ 

Dimension 

CT1200 

MOCAS  allowed  an  amount  under 
$25,000  to  be  entered  as  the  total 
contract  amount  in  the  Guaranteed 
Maximum  Shipping  Weight/Dimension 
field,  in  violation  of  DFAS  Columbus 
desk  procedure  201. 
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with  Inadequate  Controls 


Field  Name 

Screen 

Number 

Nature  of  Inadeauate  Controls 

Program  Year 

CT1510 

MOCAS  allowed  an  alpha  character 
other  than  "X"  in  this  field,  in 
violation  of  DFAS  Q)lumbus  Center 
desk  procedure  201 . 

General 

Operating 

Agency  Code 

CT1510 

In  this  field,  MOCAS  allowed  an  entry 
that  was  not  listed  in  Army  Regulation 
37-100-94,  section  225. 

Country  Code 

CT1510 

MOCAS  allowed  an  erroneous  country 
code  in  this  field. 

Fiscal  Station 
Number 

CT1510 

In  this  field,  MOCAS  allowed  a  fiscal 
station  that  did  not  correspond  to  the 
applicable  operating  agency  code  for 
t^t  fiscal  station. 

Foreign 

Military  Sales 
Country  Code 

CT1510 

MOCAS  allowed  an  erroneous  country 
code  in  this  field. 

Obligated 

Amount 

CT1510 

In  this  field,  MOCAS  allowed  an 
amount  that  exceeded  the  total 
established  for  the  contract. 

Foreign 

Military  Sales 
Countiy  Code 

CT1520 

MOCAS  allowed  an  erroneous  country 
code  in  this  field. 

Obligated 

Amount 

CT1520 

In  this  field,  MOCAS  allowed  an 
amount  that  exceeded  the  total  amount 
established  on  the  contract. 

Foreign 

Military  Sales 
Countiy  Code 

CT1530 

MOCAS  allowed  an  erroneous  country 
code  in  this  field. 

♦Also,  DFAS-Columbus  desk  procedure  201  was  in  error  because  it  stated  that 
only  numeric  entries  were  acceptable  in  the  Program  Year  field;  however,  the 
alpha  character  "X"  is  also  acceptable. 


27 


Appendix  A.  Additional  Information  on  57  MOCAS  Fields 
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Field  Name 

Screen 

Number 

Nature  of  Inadeauate  Controls 

Obligated 

Amount 

CT1530 

In  this  field,  MOCAS  allowed  an 
amount  that  exceeded  the  total  amount 
established  on  the  contract. 

Foreign 

Military  Sales 
Country  Code 

CT1540 

MOCAS  allowed  an  erroneous  country 
code  in  this  field. 

Obligated 

Amount 

CT1510 

In  this  field,  MOCAS  allowed  an 
amount  that  exceeded  the  total  amount 
established  on  the  contract. 

Similarly,  MOCAS  allowed  an  amount 
in  this  field  that,  when  added  to 
amounts  previously  obligated  on  the 
same  contract,  caused  obligations  to 
exceed  the  total  amount  established  on 
the  contract. 

Unit  Price 

CT1600 

In  this  field,  MOCAS  allowed  a  unit 
price  that  exceeded  the  total  amount 
established  on  the  contract. 

Delivery 

Schedule  Date 

CT1610 

In  this  field,  MOCAS  allowed  a 
delivery  schedule  date  that  had  already 
passed. 

Service 

Completion 

Date 

CT1700 

MOCAS  accepted  a  service  completion 
date  that  was  older  than  the  effective 
date  established  on  the  contract. 

Total  Item 
Amotmt 

CT1700 

In  this  field,  MOCAS  allowed  an 
amount  that  exceeded  the  total  amount 
of  the  contract. 
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Appendix  A.  Additional  Information  on  57  MOCAS  Fields 

with  Inadequate  Controls 


Field  Name 

Screen 

Number 

Nature  of  Inadeauate  Controls 

Program  Year 

CT3211 

MOCAS  allowed  an  alpha  character 
other  than  "X"  in  this  field,  in 
violation  of  DFAS  Q^lmnbus  Center 
desk  procedure  201 . 

Country  Code 

CT3211 

MOCAS  allowed  an  erroneous  country 
code  in  diis  field. 

Fiscal  Station 
Nmnber 

CT3211 

In  this  field,  MOCAS  allowed  a  fiscal 
station  that  did  not  correspond  to  the 
applicable  operating  agency  code  for 
that  fiscal  station. 

Foreign 

Military  Sales 
Country  Code 

CT3211 

MOCAS  allowed  an  erroneous  country 
code  in  this  field. 

Obligated 

Amount 

CT3211 

In  this  field,  MOCAS  allowed  an 
amount  that  exceeded  the  total  amount 
established  on  the  contract. 

Foreign 

Military  Sales 
Country  Code 

CT3212 

MOCAS  allowed  an  erroneous  country 
code  in  this  field. 

Obligated 

Amount 

CT3212 

MOCAS  allowed  an  amount  in  this 
field  that,  when  added  to  amounts 
previously  obligated  on  the  same 
contract,  caused  total  obligations  to 
exceed  the  amoimt  established  on  the 
contract. 

Foreign 

Military  Sales 
Country  Code 

CT3213 

MOCAS  allowed  an  erroneous  country 
code  in  this  field. 
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Appendix  A.  Additional  Information  on  57  MOCAS  Fields 
with  Inadequate  Controls 


Field  Name 

Screen 

Number 

Nature  of  Inadequate  Controls 

Obligated 

Amount 

CT3213 

MOCAS  allowed  an  amount  in  this 
field  that,  when  added  to  amounts 
previously  obligated  on  the  same 
contract,  caused  total  obligations  to 
exceed  Ae  amount  established  on  the 
contract. 

Object  Class 

Code 

CT3214 

MOCAS  allowed  this  field  to  be  left 
blank  in  violation  of  DFAS  Columbus 
Center  desk  procedure  201,  which 
required  zeroes  to  be  entered  if  no 
information  was  available. 

Foreign 

Military  Sales 
Coundy  Code 

CT3214 

MOCAS  allowed  an  erroneous  country 
code  in  this  field. 

Obligated 

Amount 

CT3214 

MOCAS  allowed  an  amount  in  this 
field  that,  when  added  to  amounts 
previously  obligated  on  the  same 
contract,  caused  total  obligations  to 
exceed  die  contract  amount. 

Service 

Completion 

Date 

CT3310 

MOCAS  accepted  a  service  completion 
date  that  had  already  passed  by  the 
time  the  contract  was  established. 

Total  Item 
Amount 

CT3310 

For  three  contract  line  item  munbers, 
MOCAS  allowed  item  amoimts  that, 
when  added,  exceeded  the  total  amount 
of  the  contract. 
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Appendix  A.  Additional  Information  on  57  MOCAS  Fields 

with  Inadequate  Controls 


Field  Name 

Screen 

Number 

Nature  of  Inadequate  Controls 

Unit  Price 

CT3410 

For  the  unit  price  and  quantity 
ordered,  MOCAS  allowed  entries  that 
made  the  total  item  amount  exceed  the 
total  contract  amount. 

For  two  contract  line  item  numbers, 
MOCAS  allowed  unit  prices  that  made 
the  total  item  amounts,  when  added, 
exceed  the  total  amount  of  the  contract. 

First  Article 
Acceptance 

Date 

CT3410 

MOCAS  accepted  a  first  article 
acceptance  date  that  was  earlier  than 
the  effective  date  of  the  contract. 

Delivery 

Schedule  Date 

CT3510 

MOCAS  accepted  a  delivery  schedule 
date  that  was  earlier  than  the  effective 
date  of  the  contract. 

Effective  Date 

CT2000 

MOCAS  allowed  an  unreasonably  old 
effective  date  to  be  established  on  the 
contract. 

Signature 

Date 

Modification 

CT2000 

On  this  contract,  MOCAS  accepted  a 
future  signature  date  that  was 
unreasonably  distant. 

Also,  on  a  contract  modification, 
MOCAS  accepted  a  signature  date  that 
was  earlier  than  the  effective  date  of 
the  contract. 

Effective  Date 

CT3110 

On  this  contract,  MOCAS  accepted  a 

future  effective  date  that  was 
unreasonably  distant. 


On  a  separate  contract,  MOCAS 
accepted  an  unreasonably  old  effective 
date  for  the  contract. 
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Appendix  A.  Additional  Information  on  57  MOCAS  Fields 
with  Inadequate  Controls 


Screen 

Field  Name  Number 

Discount  CT3120 

Terms 

International  CT3 120 

Balance  of 
Payments 
Country  Code 


International  CT3120 

Balance  of 

Payments 

Category 

Code 


Guaranteed  CT3120 

Maximum 

Shipping 

Weight/ 

Dimension 


Object  Class  CT3221 

Code 


Fiscal  Station  CT3221 

Number 


Namre  of  Inadequate  Controls 

MOCAS  accepted  unreasonably  high 
discount  rates  in  this  field. 

MOCAS  allowed  a  country  code  in  this 
field,  although  the  IBOP  indicator  field 
was  blank,  in  violation  of  DFAS 
Coliunbus  Center  desk  procedure  201. 

Separately,  MOCAS  allowed  an 
erroneous  country  code  in  this  field. 

MOCAS  allowed  an  alpha  character 
other  than  "C"  in  this  field. 

Also,  on  a  contract  for  which  DFAS 
Columbus  Center  desk  procedure  201 
required  an  entry  in  this  field,  MOCAS 
allowed  this  field  to  be  left  blank. 

MOCAS  allowed  an  amount  under 
$25,000  to  be  entered  as  the  total 
contract  amount  in  the  Guaranteed 
Maximum  Shipping  Weight/Dimension 
field,  in  violation  of  DFAS  Columbus 
Center  desk  procedure  201 . 

MOCAS  allowed  this  field  to  be  left 
blank  in  violation  of  DFAS  Columbus 
Center  desk  procedure  201,  which 
required  zeroes  to  be  entered  if  no 
information  was  available. 

In  this  field,  MOCAS  allowed  a  fiscal 
station  that  did  not  correspond  to  the 
applicable  operating  agency  code  for 
that  fiscal  station. 
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Appendix  A.  Additional  Information  on  57  MOCAS  Fields 

with  Inadequate  Controls 


Field  Name 

Screen 

Number 

Nature  of  Inadequate  Controls 

Obligated 

Amount 

CT3221 

MOCAS  allowed  an  amount  in  this 
field  that  exceeded  the  total  contract 
amount. 

Foreign 

Military  Sales 
Countiy  Code 

CT3222 

MOCAS  allowed  an  erroneous  country 
code  in  this  field. 

Obligated 

Amount 

CT3222 

MOCAS  allowed  an  amount  in  this 
field  that,  when  added  to  amounts 
previously  obligated  on  the  same 
contract,  caused  total  obligations  to 
exceed  die  contract  amount. 

Foreign 

Military  Sales 
Country  Code 

CT3223 

MOCAS  allowed  an  erroneous  country 
code  in  this  field. 

Obligated 

Amount 

CT3223 

MOCAS  allowed  an  amount  in  this 
field  that,  when  added  to  amounts 
previously  obligated  on  the  same 
contract,  caused  total  obligations  to 
exceed  &e  contract  amount. 

Fiscal  Station 
Number 

CT3224 

MOCAS  allowed  the  fiscal  station 
number  to  be  changed  on  this  data 
entry  screen.  According  to  DFAS 
Columbus  Center  desk  procedure  201, 
this  field  was  protected  and  could  not 
be  changed. 

Foreign 

Military  Sales 
Country  Code 

CT3224 

MOCAS  allowed  an  erroneous  country 
code  in  this  field. 

Appendix  A.  Additional  Information  on  57  MOCAS  Fields 
with  Inadequate  Controls 


Screen 

Field  Name  Number 

Obligated  CT3224 

Amount 


Unit  Price  CT3421 


First  Article  CT3421 

Acceptance 

Date 


Nature  of  Inadequate  Controls 

MOCAS  allowed  an  amount  in  this 
field  that,  when  added  to  amounts 
previously  obligated  on  the  same 
contract,  caused  total  obligations  to 
exceed  the  contract  amount. 

For  the  unit  price  and  quantity 
ordered,  MOCAS  allowed  entries  that 
made  the  total  item  amount  exceed  the 
total  contract  amount. 

MOCAS  accepted  a  first  article 
acceptance  date  that  was  earlier  than 
the  effective  date  of  the  contract. 


34 


Appendix  B.  Data  Corrections  Not  Made  Accurately  or  Promptly 
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Appendix  B.  Data  Corrections  Not  Made  Accurately  or  Promptly 


9 

S 

c/3 

I 

9 

u 


Tf  ^  Tf  Tf  Xf  Tf  ^  Tf  Tf 

Qv  OS  OS  ON  OS  On  On  Cn  0\  Cs  On  0\  ON 

On  On  On  On  On  On  On  On  On  On  On  On  On 

^  ^  ^  5ir*  5#*  S*'  2*^ 

03  C003903C9CQ03COCOCQ9C9 

o  oooooooooooo 

C0CdwC9O3COC9C0C9O3CO(Q 

X3  •rt-O’O’O’O’O’O'O’O’O’O’O 

&  cScBC&c&Sctic 

8  888888888888 

O  OOOOOOOOOOOO 

55  ^Z552ZZ55;2;S52:2S5 


cn  CO 
8^8^ 


^ 

®  *S  ‘3 

s  s.a 

Ill 

y*— ^  ,9  9 

HH  HH 


>* 

>> 

1  1 

>>>» 

^3 

04 

33 

& 

.&  .& 

^  33 
&& 

B 

£ 

43  43 

£  £ 

*"S 

9 

2 

a 

1 

60  60 

C  CS 

2  2 
0404 

01 

^  1 

11 

^^3  Tj  ^^3  ^^3  *T3  ’^Cl  T3 

sSssSsSsSsss 

111 

9 

•c 

888888888888 

8  ii  ij 

9 

t: 

b  b 

bbbbbbbbbbbb 

H  H  H 

Q 

CO 

8 

88 

888888888888 

W  'W  W  W  W  -W  4-*  ^  W  <«>4  ^ 

888 

^ 

9 

s 

CO 

O  O 

55  !Z 

255Z225522Z222; 

;l;z;z 

36 


Appendix  B.  Data  Corrections  Not  Made  Accurately  or  Promptly 
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Appendix  B.  Data  Corrections  Not  Made  Accurately  or  Promptly 
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Appendix  C.  Summary  of  Use  of  Reject  Listings  by  CAS  Directorates  at  DFAS  Columbus  Center 
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Appendix  D.  Desk  Procedures  for  Reject  Listings  Reviewed 
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Appendix  E.  Critical  MOCAS  Screens 


Screen  Number  Screen  Name 

CT3120  Maintain  Provisions  Data  Records 

CT3130  Maintain  Payee  Name  and  Address 

CT3221  Change  Accounting  Classification  Data  Record  -  Army 

CT3222  Change  Accounting  Classification  Data  Record  -  Air 

Force 

CT3223  Change  Accounting  Classification  Data  Record  -  Navy 

CT3224  Change  Accounting  Classification  Data  Record  -  DLA 

UNAA21  Invoice  Data  Entry 

UNAA24  Army  Disbursements 

UNAA25  Air  Force/DLA  Disbursements 

UNAA26  Navy  Disbursements 

UNAA47-  Progress  Payment  Input 
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Appendix  F.  Unauthorized  User  IdentiHcation 

Codes 


Data  in  Appendix  F  has  been  deleted  from  this  final  rq>ort.  A  detailed  listing 
of  unaudiorized  user  identification  codes  was  provided  to  the  DFAS  Columbus 
Center  in  a  draft  of  this  report.  However,  due  to  the  sensitivity  of  this 
information  it  was  deleted  from  the  final  rq)ort. 


44 


Appendix  G.  Sunmiary  of  Potential  Benefits 

Resulting  From  Audit 


Recommendation 

Reference  Description  of  Benefit 


Amount  and/or 
Type  of  Benefit 


A.l.a. 

A. 2.a. 

B.l. 

B.2. 

B.3. 

B. 4.. 
B.5. 


Internal  controls.  Using  MILDEPs' 
edit  and  validation  tables  will 
improve  accuracy  of  MOCAS  data. 

Internal  controls.  Enhancing 
MOCAS  automated  controls  will 
improve  data  accuracy. 

Internal  controls.  Improved 
guidance  on  use  of  reject  listings 
will  ensure  that  critical  listings  are 
used. 

Economy  and  efficiency. 

Correcting  errors  will  improve 
accuracy  of  accounting  data. 

Internal  controls.  Requiring  data 
entry  supervisors  to  review  the 
corrections  to  reject  listings  will 
result  in  more  accurate  data  on 
accounting  and  disbursements. 

Economy  and  efficiency.  New  or 
revised  desk  procedures  will  provide 
improved  guidance  on  working  with 
MOCAS  automated  reject  listings. 


Nonmonetary. 


Nonmonetary. 


Nonmonetary. 


Nonmonetary. 


Nonmonetary. 


Nonmonetary. 
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Appendix  G.  Summary  of  Potential  BeneHts  Resulting  from  Audit 


Recommendation 

Reference 


B.6. 


C.l. 


C.2.a., 

C.2.b., 

C.2.C. 


C.3. 


Description  of  Beneflt 


Economy  and  efficiency.  Tracking 
rejects  by  numbers  and  categories  of 
errors  will  allow  identification  of 
common  errors  in  data  entry  and 
other  opportunities  for  improving 
data  accuracy. 

Internal  controls.  Canceling  the 
66  user  IDs  will  prevent  users  from 
gaining  unauthorized  access  to 
MOCAS. 

Internal  controls.  Canceling 
unneeded  user  IDs  will  prevent 
users  from  gaining  unauthorized 
access  to  MOCAS. 

Internal  controls.  Periodic  review 
of  user  IDs  will  ensure  that  only 
authorized  users  have  access  to 
MOCAS. 


Amount  and/or 
Type  of  Benefit 


Nonmonetary. 


Nonmonetary. 


Nonmonetary. 


Nonmonetary. 
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Appendix  H.  Organizations  Visited  or  Contacted 

Office  of  the  Secretary  of  Defense 

Comptroller  of  the  Secretary  of  Defense  (Now,  Under  Secretary  of  Defense 
(Comptroller)) 


Department  of  the  Navy 

Comptroller  of  the  Navy,  Office  of  Financial  Accounting 


Defense  Organizations 

Defense  Finance  and  Accounting  Service 

Defense  Finance  and  Accounting  Service  Center,  Columbus,  OH 
Defense  Finance  and  Accounting  Service  Center,  Denver,  CO 
Defense  Finance  and  Accounting  Service  Center,  Indianapolis,  IN 
Defense  Information  Services  Organization,  Columbus,  OH 
Defense  Logistics  Agency 

Defense  Logistics  Agency  Systems  Automation  Center,  Columbus,  OH 
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Appendix  I.  Report  Distribution 

Office  of  the  Secretary  of  Defense 

Under  Secretary  of  Defense  (Comptroller) 

Assistant  to  the  Secretary  of  Defense  (Public  Affairs) 

Assistant  Secretary  of  Defense  (Command,  Control,  Communications  and  Intelligence) 


Department  of  the  Army 

Secretary  of  the  Army 

Assistant  Secretary  of  the  Army  (Financial  Management) 
Insp^tor  General,  Dq)artment  of  the  Army 
Auditor  General,  Dq)artment  of  the  Army 


Department  of  the  Navy 

Secretary  of  the  Navy 

Assistant  Secretary  of  the  Navy  (Financial  Management) 
Auditor  General,  Dq)artment  of  the  Navy 


Department  of  the  Air  Force 

Secretary  of  the  Air  Force 

Assistant  Secretary  of  the  Air  Force  (Financial  Management  and  Comptroller) 
Auditor  General,  D^artment  of  the  Air  Force 


Defense  Organizations 

Director,  Defense  Contract  Audit  Agency 
Director,  Defense  Finance  and  Accounting  Service 

Director,  Defense  Finance  and  Accounting  Service  Columbus  Center 
Director,  Defense  Logistics  Agency 
Director,  National  Security  Agency 
Director,  Defense  Information  Systems  Agency 
Director,  Defense  Security  Assistance  Agency 
Commander,  Defense  Contract  Management  Command 
Inspector  General,  Cmtral  Image^  Office 
Inspector  General,  Defense  Intelligence  Agency 
Inspector  General,  National  Security  Agency 
Director,  Defense  Logistics  Studies  Information  Exchange 
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Appendix  I.  Report  Distribution 


Non-Defense  Federal  Organizations 

Office  of  Management  and  Budget 

Technical  Information  Center,  National  Security  and  International  Affairs  Division, 
General  Accounting  Office 

Chairman  and  Ranking  Minority  Member  of  Each  of  the  Following  Congressional 
Committees  and  Subcommittees: 

Senate  Committee  on  Appropriations 

Senate  Subcommittee  on  Defense,  Committee  on  Appropriations 
Senate  Committee  on  Armed  Services 
Senate  Committee  on  Governmental  Affairs 
House  Committee  on  Appropriations 

House  Subcommittee  on  Defense,  Committee  on  Appropriations 
House  Committee  on  Armed  Services 
House  Committee  on  Government  Operations 

House  Subcommittee  on  Legislation  and  National  Security,  Committee  on 
Government  Operations 


49 


This  page  was  left  out  of  orignial  document 


Part  TV  -  Management  Comments 


Office  of  the  Under  Secretary  of  Defense 
Comments 


OFFICE  OF  THE  UNDER  SECRETARY  OF  DEFENSE 

1 100  DEFENSE  PENTAGON 
WASHINGTON.  DC  20301-1100 


(Financial  Systems) 


ocr  2  6  1994 


MEMORANDUM  FOR  DIRECTOR,  FINANCIAL  MANAGEMENT  DIRECTORATE, 
INSPECTOR  GENERAL 

SUBJECT:  Draft  Audit  Report  on  Data  Input  Controls  for  the 
Mechanization  of  Contract  Administration  Services 
Systems  (Project  No.  3FI-4001) 


Attached  is  the  Department  of  Defense  response  to  your 
August  15,  1994,  draft  audit  report  No.  3FI-4001,  on  "Data  Input 
Controls  for  the  Mechanization  of  Contract  Administration 
Services  Systems." 

Mr.  Verlon  Bass,  (703)  607-0384,  is  the  Defense  Finance  and 
Accounting  Service  point  of  contact  for  report  No.  3FI-4001. 


/2_  . 

Richard  F.  Keevey  * 
Deputy  Comptroller 
(Financial  Systems) 


Attachment: 
As  stated 
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OfHce  of  the  Under  Secretary  of  Defense  Conunents 


Defense  Finance  and  Accounting  Service 
Comments  on  Information  Requested  by  DoDIG  for 
Audit  Report  on  Data  Input  Controls  for  the  Mechanization 
of  Contract  Administration  Services  System 
(Project  Number  3FI-4001) 


DODIG  FINDING  A:  We  recommend  that  the  Director,  Defense  Finance 
and  Accounting  Service  -  Columbus  Center: 

ITEM  1 .a.  Install  the  Army' s  Data  Element  Management  Accounting 
Reporting  Table,  the  Navy's  Centralized  Master  Edit  Table,  and 
the  Air  Force's  Master  Appropriation  Reporting  Tables  in  the 
Mechanization  of  Contract  Administration  Services  system  to 
improve  data  accuracy. 

ITEM  l.b.  Establish  automated  edit  and  validation  controls  for 
data  input  fields  that  accepted  invalid  data. 


Item  1 . a :  Partially  concur.  The  Defense  Finance  and  Accounting 
Service  -  Columbus  Center  (DFAS-CO)  will  contact  the  Military 
Departments  to  explore  the  feasibility  of  obtaining  the  edit 
tables  for  installation  into  the  Mechanization  of  Contract 
Administration  Services  (MOCAS) .  We  will  develop  and  submit 
requirements  to  the  MOCAS  Central  Design  Activity  for  cost 
estimates  of  the  programming  changes.  The  system  change  request 
will  then  be  submitted  to  DFAS-HQ  for  approval  and  inclusion  in 
the  project  development  plan.  Due  to  the  size  of  the  edit 
tables,  the  current  MOCAS  data  base/table  files  will  have  to  be 
expanded.  In  addition,  MOCAS  on  line  programs  and  MILSCAP  will 
require  changes  to  recognize  the  new  edits.  Programming  time  is 
estimated  at  nine  to  12  months  with  an  estimated  implementation 
date,  assuming  a  best  case  scenario,  of  the  second  quarter  of 
FY  1996.  We  also  will  be  looking  at  adding  the  tables  to  MOCAS 
in  conjunction  with  a  prevalidation  process  for  payments.  In 
this  process,  before  an  entitlement  is  sent  out  for  payment,  the 
entitlement  is  checked  against  the  accounting  system  to  determine 
if  funds  are  available  to  make  the  payment.  In  July  1995,  we 
will  begin  prevalidating  any  payment  that  is  $5  million  or  more, 
and  in  October  1995,  we  will  begin  this  process  for  all  payments 
that  are  $1  million  or  more.  Based  on  the  success  of  the 
prevalidation  process  versus  the  cost  to  program  the  tables  into 
MOCAS,  we  will  determine  if  adding  the  tables  into  MOCAS  is 
worthwhile . 


ESTIMATED  COMPLETION  DATE:  Second  quarter  of  FY  1996. 
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Item  l.b;  Partially  Concur.  DoD  Directive  7220. 9-M,  DoD 
Accounting  Manual,  prescribes  that  accounting  systems  "shall  be 
flexible  enough  to  handle  additions  or  deletions,  including 
changes  to  accounts  or  account  codes,  classifications, 
organizations,  and  dollar  thresholds,  without  extensive  program 
or  system  changes."  Many  of  the  MOCAS  fields  identified  in  the 
draft  report,  as  having  inadequate  automated  edit  or  validation 
controls,  were  programmed  with  minimal  validations  to  provide 
flexibility  for  future  changes.  Controls  over  data  input  are 
provided  by  MOCAS  desk  procedures  and  functional  training  courses 
that  specify  the  criteria  for  data  to  be  input.  However,  we 
agree  that  additional  edits  and  validations  may  be  needed  for 
several  of  the  fields.  Therefore,  for  those  fields  we  will 
review  and  implement  system  changes  as  appropriate.  This  item 
also  will  be  reviewed  in  conjunction  with  the  prevalidation 
process  aforementioned  in  Item  l.a. 

ESTIMATED  COMPLETION  DATE:  March  31,  1995. 

D_ODIG  FINDING  B:  We  recommend  that  the  Director,  Defense  Finance 
and  Accounting  Service  ~  Columbus  Center: 

item  1.  Issue  specific  instructions  to  the  Contract 
Administration  Services  Directorates  and  their  payment  divisions 
on  which  reject  listings  from  the  Mechanization  of  Contract 
Administration  Services  system  are  critical,  and  how  these  reject 
listings  should  be  used. 

item  2.  Direct  that  errors  in  data  entry  be  corrected  for  the  92 
cases  discussed  in  this  report. 

ITEM  3.  Require  data  entry  supervisors  to: 

a.  Review  reject  listings  produced  by  the  Mechanization  of 
Contract  Administration  Services  system; 

b.  Identify  data  errors  that  need  correction;  and 

c.  Document  their  reviews. 

item  4.  -Review  desk  procedures  301,  608,  and  801  for  the  five 
reject  listings  discussed  in  this  report  to  give  specific 
guidance  on  the  use  of  reject  listings  and  procedures  for  error 
correction . 

ITEM  5.  Implement  desk  procedures  for  the  two  reject  listings 
discussed  in  this  report  for  which  no  procedures  currently  exist. 
At  a  minimum,  the  procedures  should  give  specific  guidance  on  the 
use  of  reject  listings  and  procedures  for  error  correction. 

item  6.  Continuously  track  reject  transactions  by  numbers  and 
categories  of  errors,  and  use  the  results  to  identify  common 
errors  in  data  entry  and  areas  where  data  accuracy  can  be 
improved . 
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Fbal  Report 
Rrfywr  ■■ 


gFA?  CPHMSNTS; 

Item  1;  Concur.  Specific  instructions  on  which  reject  listings 
from  the  MOCAS  system  are  critical  and  how  the  listings  should  be 
used  will  be  provided  in  the  revisions  to  desk  procedures.  The 
revisions  are  expected  to  be  completed  by  December  31,  1994, 
Periodic  internal  reviews  will  be  conducted  to  ensure  compliance 
with  desk  procedures, 

ESTIMATED  COMPLETION  DATE:  December  31,  1994. 

Item  2:  Concur.  Errors  in  data  entry  will  be  corrected  for  the 
92  cases  discussed  in  this  report. 

ESTIMATED  COMPLETION  DATE:  November  30,  1994. 

Items  3  a.  b.  and  c:  Concur.  Requirements  for  supervisor/lead 
review,  identification,  and  documentation  will  be  included  in 
revisions  to  desk  procedures. 

ESTIMATED  COMPLETION  DATE:  December  31,  1994. 

Item  4 :  Concur.  Specific  instructions  on  the  use  of  reject 
listings  and  procedures  for  error  corrections  will  be  included  in 
the  revisions  to  the  desk  procedures.  Desk  Procedures  301  and 
801  are  in  the  process  of  being  revised.  All  revisions  to  Desk 
Procedures  301,  608,  and  801  are  expected  to  be  completed  by 
December  31,  1994. 

ESTIMATED  COMPLETION  DATE:  December  31,  1994. 

Item  5:  Concur.  Desk  Procedure  703  provides  guidance  on  the  use 
of  report  UNPA350J,  Data  Reject  Report.  Desk  Procedure  602 
revisions  will  include  guidance  on  the  use  of  report  MNMA180A, 
Invoice  Accepted  Error  List . 

Item  6:  Partially  Concur.  Tracking  reject  transactions  by 
numbers  and  categories  of  errors  would  be  an  inefficient  use  of 
resources.  Revisions  to  desk  procedures  will  provide  for 
supervisory  monitoring  of  data  errors.  In  addition,  the  Quality 
Assurance  Division  will  periodically  monitor  rejected 
transactions  using  sampling  techniques  to  identify  common  errors 
in  data  entry  and  areas  where  data  accuracy  can  be  improved. 

ESTIMATED  COMPLETION  DATE:  December  31,  1994. 


Revised 
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FINDING  C:  We  recommend  that  the  Director,  Defense  Finance  and 
Accounting  Service  -  Columbus  Center: 

ITEM  1.  Terminate  the  user  identification  codes  for  the  66 
employees  discussed  in  this  report. 

ITEM  2.  Direct  Terminal  Area  Security  Officers  at  the  Defense 
Finance  and  Accounting  Service  -  Columbus  Center  to: 

a.  Throughly  review  the  "Total  Information  System  Extended 
Security  System  Batch  Utilities  Application  to  User  Relationship 
Report"  for  all  input  screens  in  the  Mechanization  of  Contract 
Administration  Services  system. 

b.  Terminate  user  identification  codes  that  are  no  longer 
required. 


c.  Correct  all  errors  identified,  including  duplicate  user 
identification  codes,  reversals  of  first  and  last  names,  and  two 
or  more  employees  with  the  same  user  identification  code. 

ITEM  3.  Require  Terminal  Area  Security  Officers  to  conduct 
semiannual  reviews  of  the  list  of  user  identification  codes,  and 
document  these  reviews. 


DFAS  COMMENTS 

Item  1;  Concur.  The  unauthorized  user  identification  codes  in 
the  draft  report  will  be  reviewed  and  terminated  as  appropriate 
by  December  31,  1994. 

ESTIMATED  COMPLETION  DATE;  December  31,  1994. 

Item  2  a.  b,  and  c:  Concur.  We  currently  are  reviewing  access 
control  in  the  Contract  Entitlement  Directorate.  The  recommended 
corrective  actions  will  be  initiated  as  part  of  that  review. 

ESTIMATED  COMPLETION  DATE:  December  31,  1994. 

Item  3;  Concur.  Semiannual  reviews  will  begin  upon  completion 
or  our  current  review. 

ESTIMATED  COMPLETION  DATE:  The  semiannual  reviews  will  begin  in 
January  1995  and  will  be  ongoing  after  that  date. 
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